old httpd processes loading the server

[ZapX.net]

Hello,

I've been noticing this problem recently where httpd processes seem to stick around and begin loading down the server. Every few days I notice this, at which time I generally restart httpd and they go away. The processes are up to a few days old. It's been loading the server to an average of 1.0 to 2.0, which is very unusual.


Now, my knowledge is limited but I don't think it is normal for httpd processes to stick around like this. Any ideas?

Thanks for any help

Brandon

[chirpy]

Brandon,

When you say they hang around, are they part of the main httpd thread? If you do:

ps axf

Is the odd httpd process part of the main httpd process tree? If not, then this is typicaly of many exploits that try to hide themselves as "standard" services. You can usually tell by running:

netstat -lpn

And seeing if there are any non-standard ports open, especially by the httpd process. If that's not the issue, ignore me

[ZapX.net]

Hello,

Thank you for your response. It looks like they are part of the main thread. here's the output of ps axf |grep httpd

18241 ? S 1:04 /usr/local/apache/bin/httpd -DSSL
11326 ? S 0:10 \_ /usr/local/apache/bin/httpd -DSSL
11327 ? S 0:08 \_ /usr/local/apache/bin/httpd -DSSL
11329 ? S 0:09 \_ /usr/local/apache/bin/httpd -DSSL
11360 ? S 0:13 \_ /usr/local/apache/bin/httpd -DSSL
11392 ? S 0:08 \_ /usr/local/apache/bin/httpd -DSSL
11449 ? S 0:09 \_ /usr/local/apache/bin/httpd -DSSL
11968 ? S 0:09 \_ /usr/local/apache/bin/httpd -DSSL
15008 ? S 0:10 \_ /usr/local/apache/bin/httpd -DSSL
16534 ? S 0:09 \_ /usr/local/apache/bin/httpd -DSSL
17308 ? S 0:08 \_ /usr/local/apache/bin/httpd -DSSL
18208 ? S 0:13 \_ /usr/local/apache/bin/httpd -DSSL
29217 ? S 0:01 \_ /usr/local/apache/bin/httpd -DSSL
30730 ? S 0:00 \_ /usr/local/apache/bin/httpd -DSSL
18167 ? S 0:00 \_ /usr/local/apache/bin/httpd -DSSL
20557 ? S 0:00 \_ /usr/local/apache/bin/httpd -DSSL

netstat -lpn just shows Apache listening on ports 80 and 443.

Thanks again,

Brandon